Storage system and control method of storage system

• US 7,809,981 B2
• Filed: 01/10/2008
• Issued: 10/05/2010
• Est. Priority Date: 06/26/2007
• Status: Expired due to Fees

• Current Assignee: Hitachi, Ltd.
• Original Assignee: Hitachi, Ltd.
• Inventors: Takada, Masanori, Nakamura, Shuji, Shimada, Kentaro
• Primary Examiner(s): Iqbal; Nadeem
• Application Number:
  US12/007,461
• Publication Number:
  US 20090006890A1
• Time in Patent Office: 999 Days
• Field of Search: 714 2- 13, 714/15, 714/16, 714 23- 27, 714/31, 714/37, 714/39, 714 42- 44, 714/47, 714/54, 714/56
• US Class Current: 714/5.11
• CPC Class Codes: G06F 11/0724 in a multiprocessor or a multi-core unit multiprocessors per se G06F15/80
• CPC Class Codes: G06F 11/0727 in a storage system, e.g. in a DASD or network based storage system drivers for digital recording or reproducing units G06F3/06; circuits for error detection or correction within digital recording or reproducing units G11B20/18; for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS], H04L67/1097
• CPC Class Codes: G06F 11/0772 Means for error signaling, e.g. using interrupts, exception flags, dedicated error registers
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: G06F 11/0793 Remedial or corrective actions recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40
• CPC Class Codes: G06F 11/2007 using redundant communication media
• CPC Class Codes: G06F 11/2092 Techniques of failing over between control units

Abstract

Provided is a storage system superior in fault tolerance. This storage system is composed of a controller having a plurality of processors and other units. When an error occurs in any one of the components in the controller, the storage system cuts off an I/O path of the controller, specifies the failed component in the cutoff status, and invalidates such failed component. Further, after invalidating the failed component, the storage system determines whether it is operable only with the normal components, cancels (releases) the cutoff of the I/O path when it determines that it is operable, and resumes operation by rebooting itself.

Claims

1. A storage system for providing data storage service to a host apparatus, comprising:

a host interface unit configured to be connectable to the host apparatus;

a disk interface unit configured to be connectable to a disk array unit having a volume storing data formed therein;

a cache memory unit connected respectively to the host interface unit and the disk interface unit and configured to cache the user data;

a switch LSI connected respectively to the host interface unit, the disk interface unit, and cache memory unit; and

a controller having a plurality of processors and connected to the switch LSI,

wherein the switch LSI cuts off an I/O path with the controller based on an error signal output when an error occurs in one of components in the controller; and

wherein the controller, after performing prescribed error handling under control of one of the plurality of processors, commands the switch LSI to cancel the cutoff.

2. The storage system according to claim 1,

wherein each of the plurality of processors determines whether the processor itself is normally operable in response to the error signal, and one processor among the processors that determined itself to be normally operable performs the prescribed error handling.

3. The storage system according to claim 2,

wherein at least one of the components in the controller has a error status register for recording a error source.

4. The storage system according to claim 3,

wherein the controller specifies the failed component based on the error status register under the control of the one processor.

5. The storage system according to claim 4,

wherein the controller sets the specified component to an inactivated status disabling the use of the specified component under the control of the one processor.

6. The storage system according to claim 5,

wherein the controller determines whether the controller itself is normally operable based on a component or components other than the component set to the inactivated status under the control of the one processor, and, when the controller determines itself to be normally operable, the controller is controlled so as to resume operation in a component other than the component set to the inactivated status.

7. The storage system according to claim 1,

wherein the storage system comprises a plurality of controllers that take charge of I/O processing to each of a plurality of volumes formed in the disk array unit;

and

when an error occurs in a component in a first controller, a second controller takes over the I/O processing under the charge of the first controller.

8. The storage system according to claim 7,

wherein the first controller, after performing the prescribed error handling, takes back the I/O processing from the second controller.

9. The storage system according to claim 7,

wherein, when the second controller determines that its load is higher than a prescribed threshold value as a result of taking over the I/O processing, the second controller performs control so that a part of the I/O processing under its own charge is taken over by a third controller.

10. The storage system according to claim 7,

wherein the cache memory unit retains backup data of control data retained by each of the plurality of controllers.

11. A method of controlling a storage system for providing data storage service to a host apparatus, comprising:

performing, under control of each processor of at least one controller, the data storage service;

detecting, under control of a switch LSI, an error signal output when an error occurs in one of components in the controller;

cutting off, under control of the switch LSI, an I/O path with the controller based on the detected error;

performing, under control of the controller, prescribed error handling while the I/O path is being cut off; and

commanding, under control of the controller, the switch LSI to cancel the cutoff.

12. The method according to claim 11,

wherein each of the plurality of processors determines whether the processor itself is normally operable based on the error signal, and one processor among the processors that determined itself to be normally operable performs the prescribed error handling.

13. The method according to claim 12,

wherein at least one component in the controller has an error status register for recording a error status.

14. The method according to claim 13,

wherein the controller specifies the failed component based on the error status register under the control of the one processor.

15. The method according to claim 14,

wherein the controller sets the specified component to an inactivated status disabling the use of the specified component under the control of the one processor.

16. The method according to claim 15,

wherein the controller determines whether the controller itself is normally operable based on a component other than the component set to the inactivated status under the control of the one processor, and, when the controller determines itself to be normally operable, the controller is controlled so as to resume operation in a component other than the component set to the inactivated status.

17. The method according to claim 11, further comprising a step of a second controller takes over the I/O processing under the charge of a first controller when a error occurs in a component in the first controller.

18. The method according to claim 11, further comprising a step of the first controller, after performing the prescribed error handling, taking back the I/O processing from the second controller.

19. The method according to claim 11,

wherein, when the second controller determines that its load is higher than a prescribed threshold value as a result of taking over the I/O processing, the second controller performs control so that a part of the I/O processing under its own charge is taken over by a third controller.

20. A unit having a plurality of components composing a storage system for providing data storage service to a host apparatus, comprising:

an error detection unit configured to detect the occurrence of an error in any one of the plurality of components;

a cutoff processing unit configured to cut off an I/O path with an external unit based on the detected occurrence of error;

an error specification unit configured to specify the failed component while the I/O path is being cut off; and

an inactivated status setting unit configured to set the specified component to a inactivated status;

wherein the cutoff processing unit cancels the cutoff after the inactivated status is set.